← Back

CVE-2013-0136

nvd nist
Published: Jun 1, 2013Modified: Apr 29, 2026

JSON object

Loading...
8.5
Vector
AV:N/AC:M/Au:S/C:C/I:C/A:C
Exploitability: 6.8 / Impact: 10.0
Source: NVD

Description

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

Affected (4)

Mutiny
3 products
Mutiny
Mutiny Appliance
Mutiny Virtual Appliance
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mutiny
Mutiny
Up to 5.0-1.10
Mutiny
Version 5.0-1.00
Mutiny Appliance
All versions
Mutiny Virtual Appliance
All versions

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cret@cert.org
US Government Resource
Source: cret@cert.org
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit

Timeline

No history available yet.